Directive: frame src

Overview

The frame-src directive specifies valid sources for nested browsing contexts loading HTML frame and iframe elements.

Note

frame-src allows you to specify where iframes in a page may be loaded from. This differs from frame-ancestors, which allows you to specify what parent source may embed a page.

Affects: <frame> and <iframe>

Required reading:

• Can I use frame-src?
• MDN Web Docs reference

Usage examples

Accepts one or more schemes or hosts, the 'self' keyword, or the 'none' keyword.

frame-src 'none'

frame-src 'self'

frame-src example.com

frame-src example.com example.org

frame-src https://*.example.com

frame-src https:

Fallbacks

✅ frame-src will fallback to child-src, which will fallback to default-src if it is undefined.

• default-src
  • child-src
    • frame-src

Possible errors

• CSP-0100 — [ERROR] directive %s has an invalid value %s

For developers

ABNF (CSP3)

directive-name  = "frame-src"
directive-value = serialized-source-list

See ABNF: serialized-source-list

Type

• source-list in CSP2
• serialized-source-list in CSP3

References

• CSP Level 2 reference
• CSP Level 3 reference
• MDN Web Docs reference
• Can I use frame-src?